https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-10988.htmlhttps://patchthecve.com/cve/CVE-2025-10988.htmlTue, 27 Oct 2026 08:16:51 +0000MEDIUM 6.3: A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggestedhttps://patchthecve.com/cve/CVE-2025-10987.htmlhttps://patchthecve.com/cve/CVE-2025-10987.htmlTue, 27 Oct 2026 08:16:51 +0000MEDIUM 6.3: A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate the https://patchthecve.com/cve/CVE-2025-10278.htmlhttps://patchthecve.com/cve/CVE-2025-10278.htmlTue, 27 Oct 2026 08:16:51 +0000MEDIUM 6.3: A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and mahttps://patchthecve.com/cve/CVE-2025-10277.htmlhttps://patchthecve.com/cve/CVE-2025-10277.htmlTue, 27 Oct 2026 08:16:51 +0000MEDIUM 6.3: A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The https://patchthecve.com/cve/CVE-2025-10276.htmlhttps://patchthecve.com/cve/CVE-2025-10276.htmlTue, 27 Oct 2026 08:16:51 +0000MEDIUM 6.3: A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The exploithttps://patchthecve.com/cve/CVE-2025-10275.htmlhttps://patchthecve.com/cve/CVE-2025-10275.htmlTue, 27 Oct 2026 08:16:51 +0000MEDIUM 6.3: A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The attack may be launched remotely. The exploit has been made availablhttps://patchthecve.com/cve/CVE-2025-2708.htmlhttps://patchthecve.com/cve/CVE-2025-2708.htmlMon, 26 Oct 2026 17:17:11 +0000MEDIUM 5.4: A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The ehttps://patchthecve.com/cve/CVE-2025-2707.htmlhttps://patchthecve.com/cve/CVE-2025-2707.htmlMon, 26 Oct 2026 17:17:11 +0000MEDIUM 5.4: A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. Th